Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus Audit File Foremost started at Sun Mar 1 00:28:43 2026 Invocation: foremost -v -i virtual_machine_ram.bin Output directory: /home/cato/ctf/2026/srdnlen_quals/forensic/chapter2/output Configuration file: /etc/foremost.conf ------------------------------------------------------------------ File: virtual_machine_ram.bin Start: Sun Mar 1 00:28:43 2026 Length: 128 MB (134221824 bytes) Num Name (bs=512) Size File Offset Comment 0: 00041511.jpg 225 KB 21253656 1: 00045798.jpg 110 KB 23448600 2: 00049393.jpg 171 KB 25289240 3: 00104056.gif 840 B 53276672 (168 x 1) 4: 00104770.gif 60 B 53642400 (12 x 16) 5: 00104770_1.gif 82 B 53642464 (13 x 16) 6: 00104770_2.gif 114 B 53642552 (16 x 16) 7: 00103872.bmp 43 KB 53182464 (182 x 237) 8: 00104770.bmp 5 KB 53642672 (310 x 35) 9: 00146504.bmp 576 KB 75010048 (512 x 384) 10: 00014799.wav 36 B 7577580 11: 00038872.wav 676 KB 19902464 12: 00043867.avi 11 KB 22459912 13: 00046949.avi 143 KB 24038224 14: 00056278.wav 36 B 28814684 15: 00072813.wav 676 KB 37280640 16: 00094229.avi 143 KB 48245584 17: 00099048.wav 1 KB 50712576 18: 00039384.ole 5 KB 20164608 19: 00041504.ole 13 KB 21250048 20: 00080064.ole 3 KB 40992768 21: 00080096.ole 3 KB 41009152 22: 00134328.ole 3 KB 68775936 23: 00134351.ole 3 KB 68788160 24: 00136808.ole 3 KB 70045696 25: 00024392.dll 460 KB 12488704 04/23/1999 00:45:39 26: 00034840.exe 28 KB 17838080 06/30/2000 06:00:31 27: 00035216.dll 68 KB 18030592 04/23/1999 16:38:33 28: 00035816.exe 84 KB 18337792 04/29/1998 03:43:39 29: 00036248.dll 72 KB 18558976 04/23/1999 16:37:42 30: 00036416.exe 304 KB 18644992 07/03/2000 01:48:09 31: 00037032.dll 482 KB 18960384 06/06/2000 23:01:57 32: 00038984.dll 172 KB 19959808 04/23/1999 16:37:36 33: 00039344.dll 236 KB 20144128 04/23/1999 16:39:10 34: 00040032.exe 60 KB 20496384 11/21/2000 15:17:04 35: 00040584.dll 44 KB 20779008 04/23/1999 16:38:11 36: 00040744.dll 52 KB 20860928 04/23/1999 16:37:34 37: 00041304.dll 84 KB 21147648 04/23/1999 16:38:30 38: 00041480.dll 120 KB 21237760 04/23/1999 16:37:37 39: 00042312.exe 28 KB 21663744 04/29/1998 02:45:47 40: 00042464.dll 362 KB 21741568 06/06/2000 23:21:28 41: 00044176.exe 68 KB 22618112 04/23/1998 03:35:12 42: 00044400.exe 132 KB 22732800 04/23/1999 02:18:57 43: 00046392.dll 32 KB 23752704 06/27/2000 18:42:52 44: 00046752.exe 24 KB 23937024 06/30/2000 06:15:08 45: 00046800.dll 36 KB 23961600 04/23/1999 16:37:37 46: 00046976.dll 668 KB 24051712 11/21/2000 15:18:11 47: 00049808.dll 176 KB 25501696 07/03/2000 01:50:07 48: 00050824.dll 76 KB 26021888 06/30/2000 06:17:32 49: 00051224.dll 20 KB 26226688 06/27/2000 18:42:48 50: 00052064.dll 144 KB 26656768 04/23/1999 16:39:00 51: 00057720.dll 293 KB 29552640 06/06/2000 23:21:20 52: 00058424.dll 88 KB 29913088 06/30/2000 06:17:32 53: 00059856.exe 132 KB 30646272 04/23/1999 02:18:57 54: 00060416.dll 24 KB 30932992 04/23/1999 16:38:40 55: 00070672.dll 196 KB 36184064 04/23/1999 16:37:51 56: 00071960.dll 136 KB 36843520 04/23/1999 16:37:54 57: 00073032.exe 176 KB 37392384 03/18/1998 22:04:02 58: 00074680.exe 176 KB 38236160 03/18/1998 22:04:02 59: 00076840.dll 795 KB 39342080 06/06/2000 23:21:25 60: 00079328.dll 24 KB 40615936 04/23/1999 16:38:46 61: 00080024.dll 140 KB 40972288 06/30/2000 06:17:32 62: 00081368.exe 24 KB 41660416 06/30/2000 06:15:08 63: 00081936.dll 36 KB 41951232 06/30/2000 06:17:32 64: 00082128.dll 124 KB 42049536 06/30/2000 05:16:36 65: 00082384.dll 76 KB 42180608 10/17/1998 09:54:50 66: 00083584.dll 1 MB 42795008 04/23/1999 16:37:36 67: 00088240.dll 421 KB 45178880 11/03/1999 00:57:56 68: 00089632.exe 56 KB 45891584 06/30/2000 06:11:16 69: 00090992.exe 304 KB 46587904 07/03/2000 01:48:09 70: 00092040.exe 60 KB 47124480 11/21/2000 15:17:04 71: 00092544.dll 76 KB 47382528 06/30/2000 06:17:32 72: 00092704.dll 392 KB 47464448 06/17/1998 18:52:10 73: 00094000.exe 28 KB 48128000 06/30/2000 06:00:31 74: 00094264.exe 32 KB 48263168 04/23/1999 01:30:00 75: 00094792.dll 140 KB 48533504 02/22/1999 19:48:21 76: 00096072.dll 480 KB 49188864 06/30/2000 05:27:07 77: 00098808.dll 398 KB 50589696 06/06/2000 23:21:23 78: 00103152.dll 164 KB 52813824 04/23/1999 16:38:20 79: 00103720.dll 17 KB 53104640 08/31/1999 23:07:49 80: 00104112.dll 240 KB 53305344 04/19/1999 15:29:48 81: 00104800.dll 383 KB 53657600 06/06/2000 23:21:33 82: 00106336.dll 2 MB 54444032 06/06/2000 23:21:20 83: 00112544.dll 580 KB 57622528 06/30/2000 06:17:34 84: 00113848.dll 1 MB 58290176 03/06/1999 09:02:12 85: 00119856.dll 17 KB 61366272 04/23/1999 16:39:21 86: 00122392.dll 164 KB 62664704 04/23/1999 16:38:55 87: 00122984.exe 60 KB 62967808 06/30/2000 06:12:01 88: 00124112.exe 60 KB 63545344 06/30/2000 06:12:01 89: 00125024.dll 84 KB 64012288 06/30/2000 06:17:32 90: 00125704.dll 120 KB 64360448 06/30/2000 06:17:33 91: 00127096.dll 28 KB 65073152 06/30/2000 06:17:32 92: 00127216.exe 72 KB 65134592 06/30/2000 06:12:33 93: 00127808.exe 72 KB 65437696 06/30/2000 06:12:33 94: 00128376.dll 256 KB 65728512 06/30/2000 06:17:35 95: 00129656.dll 36 KB 66383872 06/30/2000 06:17:35 96: 00129856.dll 72 KB 66486272 06/30/2000 06:17:34 97: 00130000.dll 89 KB 66560000 07/18/1999 17:06:44 98: 00132464.exe 56 KB 67821568 06/30/2000 06:11:16 99: 00133256.exe 44 KB 68227072 04/29/1998 02:56:24 100: 00133784.dll 28 KB 68497408 06/30/2000 06:17:33 101: 00136552.dll 24 KB 69914624 06/30/2000 05:15:10 102: 00137760.exe 336 KB 70533120 01/28/1998 17:12:18 103: 00144784.exe 20 KB 74129408 05/24/2000 11:51:54 104: 00147880.exe 29 KB 75714560 06/06/2000 20:41:52 Finish: Sun Mar 1 00:28:45 2026 105 FILES EXTRACTED jpg:= 3 gif:= 4 bmp:= 3 rif:= 8 ole:= 7 exe:= 80 ------------------------------------------------------------------ Foremost finished at Sun Mar 1 00:28:45 2026